Mic92
/
stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

treewide: don't reference <secrets> explicitly

This commit is contained in:
tv 2023-09-11 15:31:13 +02:00
parent 8fc162ee3d
commit 5370e04857
28 changed files with 44 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
kartei/makefu/default.nix
View File

@ -51,7 +51,7 @@
ssh.pubkey = readFile pubkey-path; ssh.pubkey = readFile pubkey-path;
# We assume that if the sshd pubkey exits then there must be a privkey in # We assume that if the sshd pubkey exits then there must be a privkey in
# the screts store as well # the screts store as well
ssh.privkey.path = <secrets/ssh_host_ed25519_key>; ssh.privkey.path = "${config.krebs.secret.directory}/ssh_host_ed25519_key";
}) })
host host
]; ];

2
kartei/tv/default.nix
View File

@ -43,7 +43,7 @@ in {
}) })
(host: mkIf (host.config.ssh.pubkey != null) { (host: mkIf (host.config.ssh.pubkey != null) {
ssh.privkey = mapAttrs (const mkDefault) { ssh.privkey = mapAttrs (const mkDefault) {
path = config.krebs.secret.file "ssh.id_${host.config.ssh.privkey.type}"; path = "${config.krebs.secret.directory}/ssh.id_${host.config.ssh.privkey.type}";
type = head (toList (builtins.match "ssh-([^ ]+) .*" host.config.ssh.pubkey)); type = head (toList (builtins.match "ssh-([^ ]+) .*" host.config.ssh.pubkey));
}; };
}) })

2
krebs/1systems/hotdog/config.nix
View File

@ -22,7 +22,7 @@
]; ];
krebs.build.host = config.krebs.hosts.hotdog; krebs.build.host = config.krebs.hosts.hotdog;
krebs.hosts.hotdog.ssh.privkey.path = <secrets/ssh.id_ed25519>; krebs.hosts.hotdog.ssh.privkey.path = "${config.krebs.secret.directory}/ssh.id_ed25519";
krebs.pages.enable = true; krebs.pages.enable = true;
boot.isContainer = true; boot.isContainer = true;

2
krebs/1systems/puyak/config.nix
View File

@ -113,7 +113,7 @@
]; ];
krebs.build.host = config.krebs.hosts.puyak; krebs.build.host = config.krebs.hosts.puyak;
krebs.hosts.puyak.ssh.privkey.path = <secrets/ssh.id_ed25519>; krebs.hosts.puyak.ssh.privkey.path = "${config.krebs.secret.directory}/ssh.id_ed25519";
sound.enable = false; sound.enable = false;
boot = { boot = {

2
krebs/1systems/wolf/config.nix
View File

@ -51,7 +51,7 @@ in
# uninteresting stuff # uninteresting stuff
##################### #####################
krebs.build.host = config.krebs.hosts.wolf; krebs.build.host = config.krebs.hosts.wolf;
krebs.hosts.wolf.ssh.privkey.path = <secrets/ssh.id_ed25519>; krebs.hosts.wolf.ssh.privkey.path = "${config.krebs.secret.directory}/ssh.id_ed25519";
boot.initrd.availableKernelModules = [ boot.initrd.availableKernelModules = [
"ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "virtio_blk" "ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "virtio_blk"

2
krebs/2configs/cache.nsupdate.info.nix
View File

@ -9,7 +9,7 @@ in {
enable = true; enable = true;
server = "ipv4.nsupdate.info"; server = "ipv4.nsupdate.info";
username = domain; username = domain;
password = import ((toString <secrets>) + "/nsupdate-cache.nix"); password = import "${config.krebs.secret.directory}/nsupdate-cache.nix";
domains = [ domain ]; domains = [ domain ];
use= "if, if=et0"; use= "if, if=et0";
# use = "web, web=http://ipv4.nsupdate.info/myip"; # use = "web, web=http://ipv4.nsupdate.info/myip";

2
krebs/2configs/matterbridge.nix
View File

@ -2,7 +2,7 @@
services.matterbridge = { services.matterbridge = {
enable = true; enable = true;
configPath = let configPath = let
bridgeBotToken = lib.strings.fileContents <secrets/telegram.token>; bridgeBotToken = lib.strings.fileContents "${config.krebs.secret.directory}/telegram.token";
in in
toString ((pkgs.formats.toml {}).generate "config.toml" { toString ((pkgs.formats.toml {}).generate "config.toml" {
general = { general = {

4
krebs/2configs/secret-passwords.nix
View File

@ -1,7 +1,7 @@
{ lib, ... }: { config, lib, ... }:
with lib; with lib;
{ {
users.extraUsers = users.extraUsers =
mapAttrs (_: h: { hashedPassword = h; }) mapAttrs (_: h: { hashedPassword = h; })
(import <secrets/hashedPasswords.nix>); (import "${config.krebs.secret.directory}/hashedPasswords.nix");
} }

4
krebs/2configs/shack/gitlab-runner.nix
View File

@ -1,4 +1,4 @@
{ pkgs,lib, ... }: { config, lib, pkgs, ... }:
{ {
boot.kernel.sysctl."net.ipv4.ip_forward" = true; boot.kernel.sysctl."net.ipv4.ip_forward" = true;
services.gitlab-runner = { services.gitlab-runner = {
@ -10,7 +10,7 @@
# File should contain at least these two variables: # File should contain at least these two variables:
# `CI_SERVER_URL` # `CI_SERVER_URL`
# `REGISTRATION_TOKEN` # `REGISTRATION_TOKEN`
registrationConfigFile = toString <secrets/shackspace-gitlab-ci>; registrationConfigFile = "${config.krebs.secret.directory}/shackspace-gitlab-ci";
dockerImage = "alpine"; dockerImage = "alpine";
dockerVolumes = [ dockerVolumes = [
"/nix/store:/nix/store:ro" "/nix/store:/nix/store:ro"

5
krebs/2configs/shack/grafana.nix
View File

@ -1,7 +1,6 @@
let { config, ... }: let
port = 3000; port = 3000;
in { in {
networking.firewall.allowedTCPPorts = [ port ]; # legacy networking.firewall.allowedTCPPorts = [ port ]; # legacy
services.nginx.virtualHosts."grafana.shack" = { services.nginx.virtualHosts."grafana.shack" = {
locations."/" = { locations."/" = {
@ -25,6 +24,6 @@ in {
users.allowOrgCreate = true; users.allowOrgCreate = true;
users.autoAssignOrg = true; users.autoAssignOrg = true;
auth.anonymous.enable = true; auth.anonymous.enable = true;
security = import <secrets/grafana_security.nix>; security = import "${config.krebs.secret.directory}/grafana_security.nix";
}; };
} }

2
krebs/2configs/shack/muell_caller.nix
View File

@ -21,7 +21,7 @@ let
install -m755 -D call.py $out/bin/call-muell install -m755 -D call.py $out/bin/call-muell
''; '';
}; };
cfg = "${toString <secrets>}/tell.json"; cfg = "${config.krebs.secret.directory}/tell.json";
in { in {
systemd.services.call_muell = { systemd.services.call_muell = {
description = "call muell"; description = "call muell";

2
krebs/2configs/shack/muell_mail.nix
View File

@ -9,7 +9,7 @@ let
sha256 = "0hgchwam5ma96s2v6mx2jfkh833psadmisjbm3k3153rlxp46frx"; sha256 = "0hgchwam5ma96s2v6mx2jfkh833psadmisjbm3k3153rlxp46frx";
}) { mkYarnPackage = pkgs.yarn2nix-moretea.mkYarnPackage; }; }) { mkYarnPackage = pkgs.yarn2nix-moretea.mkYarnPackage; };
home = "/var/lib/muell_mail"; home = "/var/lib/muell_mail";
cfg = toString <secrets/shack/muell_mail.js>; cfg = "${config.krebs.secret.directory}/shack/muell_mail.js";
in { in {
users.users.muell_mail = { users.users.muell_mail = {
inherit home; inherit home;

2
krebs/2configs/shack/prometheus/unifi.nix
View File

@ -5,6 +5,6 @@
unifiAddress = "https://unifi.shack:8443/"; unifiAddress = "https://unifi.shack:8443/";
unifiInsecure = true; unifiInsecure = true;
unifiUsername = "prometheus"; # needed manual login after setup to confirm the password unifiUsername = "prometheus"; # needed manual login after setup to confirm the password
unifiPassword = lib.replaceStrings ["\n"] [""] (builtins.readFile <secrets/shack/unifi-prometheus-pw>); unifiPassword = lib.replaceStrings ["\n"] [""] (builtins.readFile "${config.krebs.secret.directory}/shack/unifi-prometheus-pw");
}; };
} }

2
krebs/2configs/shack/s3-power.nix
View File

@ -10,7 +10,7 @@ let
}) { mkYarnPackage = pkgs.yarn2nix-moretea.mkYarnPackage; }; }) { mkYarnPackage = pkgs.yarn2nix-moretea.mkYarnPackage; };
home = "/var/lib/s3-power"; home = "/var/lib/s3-power";
cfg = toString <secrets/shack/s3-power.json>; cfg = "${config.krebs.secret.directory}/shack/s3-power.json";
in { in {
users.users.s3_power = { users.users.s3_power = {
inherit home; inherit home;

4
krebs/3modules/retiolum-bootstrap.nix
View File

@ -22,8 +22,8 @@ in
default = "${config.krebs.secret.directory}/tinc.krebsco.de.key"; default = "${config.krebs.secret.directory}/tinc.krebsco.de.key";
}; };
# in use: # in use:
# <secrets/tinc.krebsco.de.crt> # ${config.krebs.secret.directory}/tinc.krebsco.de.crt
# <secrets/tinc.krebsco.de.key> # ${config.krebs.secret.directory}/tinc.krebsco.de.key
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {

12
krebs/3modules/secret.nix
View File

@ -7,13 +7,17 @@ in {
default = toString <secrets>; default = toString <secrets>;
type = types.absolute-pathname; type = types.absolute-pathname;
}; };
file = mkOption {
default = relpath: "${cfg.directory}/${relpath}";
readOnly = true;
};
files = mkOption { files = mkOption {
type = with pkgs.stockholm.lib.types; attrsOf secret-file; type = with pkgs.stockholm.lib.types; attrsOf secret-file;
default = {}; default = {};
apply = mapAttrs (name: secret-file:
if types.absolute-pathname.check secret-file.source-path then
secret-file
else
secret-file // {
source-path = "${config.krebs.secret.directory}/secret-file.source-path";
}
);
}; };
}; };
config = lib.mkIf (cfg.files != {}) { config = lib.mkIf (cfg.files != {}) {

2
krebs/5pkgs/simple/generate-secrets/default.nix
View File

@ -39,7 +39,7 @@ pkgs.writers.writeDashBin "generate-secrets" ''
}; };
}; };
}; };
ssh.privkey.path = <secrets/ssh.id_ed25519>; ssh.privkey.path = "\''${config.krebs.secret.directory}/ssh.id_ed25519";
ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)"; ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)";
}; };
EOF EOF

2
lib/types.nix
View File

@ -340,7 +340,7 @@ rec {
}; };
source-path = mkOption { source-path = mkOption {
type = str; type = str;
default = toString <secrets> + "/${config.name}"; default = config.name;
defaultText = "‹secrets/‹name››"; defaultText = "‹secrets/‹name››";
}; };
}; };

2
tv/2configs/binary-cache/default.nix
View File

@ -11,7 +11,7 @@
services.nix-serve = { services.nix-serve = {
enable = true; enable = true;
secretKeyFile = toString <secrets> + "/nix-serve.key"; secretKeyFile = "${config.krebs.secret.directory}/nix-serve.key";
}; };
services.nginx = { services.nginx = {

6
tv/2configs/default.nix
View File

@ -10,7 +10,6 @@ with import ./lib;
networking.hostName = config.krebs.build.host.name; networking.hostName = config.krebs.build.host.name;
imports = [ imports = [
<secrets>
./backup.nix ./backup.nix
./bash ./bash
./htop.nix ./htop.nix
@ -28,6 +27,11 @@ with import ./lib;
defaultUserShell = "/run/current-system/sw/bin/bash"; defaultUserShell = "/run/current-system/sw/bin/bash";
mutableUsers = false; mutableUsers = false;
users = { users = {
root = {
openssh.authorizedKeys.keys = [
config.krebs.users.tv.pubkey
];
};
tv = { tv = {
inherit (config.krebs.users.tv) home uid; inherit (config.krebs.users.tv) home uid;
isNormalUser = true; isNormalUser = true;

4
tv/2configs/gitrepos.nix
View File

@ -178,9 +178,7 @@ with import ./lib;
''; '';
}; };
}; };
} // }
# TODO don't put secrets/repos.nix into the store
import <secrets/repos.nix> { inherit config lib pkgs; }
); );
irc-announce = args: pkgs.git-hooks.irc-announce (recursiveUpdate { irc-announce = args: pkgs.git-hooks.irc-announce (recursiveUpdate {

2
tv/2configs/initrd/sshd.nix
View File

@ -12,6 +12,6 @@
ignoreEmptyHostKeys = true; ignoreEmptyHostKeys = true;
}; };
boot.initrd.secrets = { boot.initrd.secrets = {
"/etc/ssh/ssh_host_rsa_key" = <secrets/initrd/ssh_host_rsa_key>; "/etc/ssh/ssh_host_rsa_key" = "${config.krebs.secret.directory}/initrd/ssh_host_rsa_key";
}; };
} }

2
tv/2configs/ppp.nix
View File

@ -1,7 +1,7 @@
with import ./lib; with import ./lib;
{ config, pkgs, ... }: let { config, pkgs, ... }: let
cfg = { cfg = {
pin = "@${toString <secrets/o2.pin>}"; pin = "@${config.krebs.secret.directory}/o2.pin";
ttys.ppp = "/dev/ttyACM0"; ttys.ppp = "/dev/ttyACM0";
ttys.com = "/dev/ttyACM1"; ttys.com = "/dev/ttyACM1";
}; };

2
tv/2configs/wiregrill.nix
View File

@ -12,7 +12,7 @@ in
optional (cfg.net.ip4 != null) cfg.net.ip4.addr ++ optional (cfg.net.ip4 != null) cfg.net.ip4.addr ++
optional (cfg.net.ip6 != null) cfg.net.ip6.addr; optional (cfg.net.ip6 != null) cfg.net.ip6.addr;
listenPort = 51820; listenPort = 51820;
privateKeyFile = (toString <secrets>) + "/wiregrill.key"; privateKeyFile = "${config.krebs.secret.directory}/wiregrill.key";
allowedIPsAsRoutes = true; allowedIPsAsRoutes = true;
peers = mapAttrsToList peers = mapAttrsToList
(_: host: { (_: host: {

4
tv/3modules/charybdis/default.nix
View File

@ -17,11 +17,11 @@ in {
}; };
ssl_dh_params = mkOption { ssl_dh_params = mkOption {
type = types.absolute-pathname; type = types.absolute-pathname;
default = toString <secrets> + "/charybdis.dh.pem"; default = "${config.krebs.secret.directory}/charybdis.dh.pem";
}; };
ssl_private_key = mkOption { ssl_private_key = mkOption {
type = types.absolute-pathname; type = types.absolute-pathname;
default = toString <secrets> + "/charybdis.key.pem"; default = "${config.krebs.secret.directory}/charybdis.key.pem";
}; };
sslport = mkOption { sslport = mkOption {
type = types.int; type = types.int;

2
tv/3modules/ejabberd/default.nix
View File

@ -20,7 +20,7 @@ in {
certfiles = mkOption { certfiles = mkOption {
type = types.listOf types.absolute-pathname; type = types.listOf types.absolute-pathname;
default = [ default = [
(toString <secrets> + "/ejabberd.pem") "${config.krebs.secret.directory}/ejabberd.pem"
]; ];
}; };
configFile = mkOption { configFile = mkOption {

2
tv/3modules/wwan.nix
View File

@ -19,7 +19,7 @@ with import ./lib;
}; };
tv.wwan.secrets = mkOption { tv.wwan.secrets = mkOption {
type = with types; pathname; type = with types; pathname;
default = toString <secrets/wwan.json>; default = "${config.krebs.secret.directory}/wwan.json";
# format: {"pin1":number} # format: {"pin1":number}
}; };
}; };

2
tv/3modules/x0vncserver.nix
View File

@ -9,7 +9,7 @@ in {
}; };
enable = mkEnableOption "tv.x0vncserver"; enable = mkEnableOption "tv.x0vncserver";
pwfile = mkOption { pwfile = mkOption {
default = toString <secrets> + "/vncpasswd"; default = "${config.krebs.secret.directory}/vncpasswd";
description = '' description = ''
Use vncpasswd to edit pwfile. Use vncpasswd to edit pwfile.
See: nix-shell -p tigervnc --run 'man vncpasswd' See: nix-shell -p tigervnc --run 'man vncpasswd'